From 4c6fd59fcd6a3c5235ed4f946313329cefbed818 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sun, 3 Sep 2023 21:32:36 +0100 Subject: cc-wrapper: ensure NIX_HARDENING_ENABLE fortify3 implies fortify too even if fortify3 is in hardening_unsupported_flags --- pkgs/build-support/cc-wrapper/add-hardening.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'pkgs') diff --git a/pkgs/build-support/cc-wrapper/add-hardening.sh b/pkgs/build-support/cc-wrapper/add-hardening.sh index 8d02b4e5124..8cd63e46095 100644 --- a/pkgs/build-support/cc-wrapper/add-hardening.sh +++ b/pkgs/build-support/cc-wrapper/add-hardening.sh @@ -10,6 +10,13 @@ for flag in ${NIX_HARDENING_ENABLE_@suffixSalt@-}; do hardeningEnableMap["$flag"]=1 done +# fortify3 implies fortify enablement - make explicit before +# we filter unsupported flags because unsupporting fortify3 +# doesn't mean we should unsupport fortify too +if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then + hardeningEnableMap["fortify"]=1 +fi + # Remove unsupported flags. for flag in @hardening_unsupported_flags@; do unset -v "hardeningEnableMap[$flag]" @@ -19,7 +26,7 @@ for flag in @hardening_unsupported_flags@; do fi done -# make fortify and fortify3 mutually exclusive +# now make fortify and fortify3 mutually exclusive if [[ -n "${hardeningEnableMap[fortify3]-}" ]]; then unset -v "hardeningEnableMap['fortify']" fi -- cgit 1.4.1